TorBruteforce

A Python-based brute force tool that supports login attempts for SSH, FTP, and web form authentication. This tool is intended for ethical hacking and penetration testing on systems for which you have explicit permission.

About

This project provides a multi-protocol brute force tool designed for security researchers and penetration testers. It supports SSH, FTP, and web form authentication brute forcing, with optional Tor integration for anonymizing web form requests. The tool is built for educational purposes and authorized security assessments only.

Features

• SSH Brute Force: Uses paramiko to attempt SSH logins with a username and password list.
• FTP Brute Force: Uses Python's ftplib to attempt FTP logins.
• Web Form Brute Force: Uses requests to send POST login forms, with optional Tor network support for anonymization.
• Easy-to-Use CLI: Accepts parameters for protocol, target details, and password list file.
• Tor Integration: For web form brute forcing, routes requests through Tor's SOCKS5 proxy to anonymize the origin IP.

Prerequisites

• Python 3.x
• Python packages: paramiko, requests

Install dependencies with:

pip install paramiko requests

• For Tor anonymization:
  • Install and run Tor.
  • On most systems, Tor runs a SOCKS5 proxy listening on 127.0.0.1:9050 by default.
  • For SSH and FTP brute force anonymization via Tor, use external tools like torsocks or proxychains when running the script.

How to Save the Script

1. Copy the Python script into a text editor.
2. Save the file as brute_force.py (ensure the .py extension).
3. Prepare a password list file (e.g., passwords.txt) with one password per line.
4. Place the password list in the same directory or provide the absolute file path when running.

Usage

Run the script from the command line:

python3 brute_force.py --help

This displays usage instructions and protocol-specific arguments.

SSH Brute Force

python3 brute_force.py ssh <host> <port> <username> <password_list_file>

Example:

python3 brute_force.py ssh 192.168.1.10 22 root passwords.txt

To route SSH over Tor:

torsocks python3 brute_force.py ssh 192.168.1.10 22 root passwords.txt

Note: Ensure torsocks and the Tor service are installed and running.

FTP Brute Force

python3 brute_force.py ftp <host> <port> <username> <password_list_file>

Example:

python3 brute_force.py ftp 192.168.1.20 21 admin passwords.txt

To route FTP over Tor:

torsocks python3 brute_force.py ftp 192.168.1.20 21 admin passwords.txt

Web Form Brute Force

python3 brute_force.py web <url> <username_field> <password_field> <username> <password_list_file>

Example:

python3 brute_force.py web http://target.com/login username password admin passwords.txt

This forces HTTP POST requests through Tor’s SOCKS5 proxy at 127.0.0.1:9050. Ensure the Tor service is running:

tor

Verify Tor usage (optional):

curl --socks5-hostname 127.0.0.1:9050 http://check.torproject.org

How It Works

1. Password List Loading: Reads passwords from the specified text file.
2. Protocol Selection: Based on CLI arguments, selects SSH, FTP, or web form brute forcing.
3. Brute Force Loop: Iterates through each password, attempting login.
4. Success/Failure Detection:
   • For SSH/FTP: Catches authentication exceptions.
   • For web forms: Analyzes HTTP responses.
5. Tor Anonymization:
   • For web forms: The requests library is configured to use Tor’s SOCKS5 proxy.
   • For SSH/FTP: External utilities like torsocks proxy the entire Python process through Tor.

Ethical Reminder

• Only test systems you own or have explicit authorization to test.
• Unauthorized brute forcing or scanning is illegal and unethical.
• Use responsibly for learning or authorized security assessments only.

Troubleshooting

• Password List Not Found: Ensure the filepath to the password list is correct.
• Web Brute Force Issues: Customize success detection logic based on the target login page’s response.
• Tor Not Working: Verify the Tor service is running locally for web form proxying.
• SSH/FTP over Tor: Ensure torsocks or proxychains is installed and configured correctly.

License

This tool is provided for educational purposes under the MIT License. See the LICENSE file for details.

Contact

For questions or improvements, open an issue or pull request on the GitHub repository.

Repository URL

The GitHub repository for this project is:
https://github.com/harriiinnii/TorBruteforce

Footer

© 2025 GitHub, Inc.

---

Thank you for exploring this tool responsibly!